3 ms·

The malware contains some hardcoded domains: news.thaprior.net blog.eduelects.com cdn.mirror-codes.net status.sublineover.net Just out of curiosity I did a si

The malware contains some hardcoded domains: news.thaprior.net blog.eduelects.com cdn.mirror-codes.net status.sublineover.net Just out of curiosity I did a simple search and found no mention of any of those domains, except for status.sublineover.net which is being reported here: https://raw.githubusercontent.com/shargon/Fwhibbit/master/TorStats/dns_log.txt https://raw.githubusercontent.com/shargon/Fwhibbit/master/To... Which is stored on a 4 years old project by what seems to be a ethical hackers group: https://github.com/shargon/Fwhibbit https://github.com/shargon/Fwhibbit (possibly related to: https://fwhibbit.es https://fwhibbit.es )

lgats 6y ago
https://domain.glass/status.sublineover.net https://domain.glass/status.sublineover.net -registered 2015-12-09 -cisco umbrella ranked intermittently since 2020-07 https://domain.glass/news.thaprior.net https://domain.glass/news.thaprior.net -registered 2015-12-09 -intermittent cisco umbrella ranking since 2021-01-31 https://domain.glass/cdn.mirror-codes.net https://domain.glass/cdn.mirror-codes.net -registered 2015-12-10 https://domain.glass/blog.eduelects.com https://domain.glass/blog.eduelects.com -registered 2015-12-09 All domains registered with Web4Africa (Pty) Ltd, hosting provided by Deltahost PTR, Kiev, Ukraine